@fourier-labs/harbour-contracts 0.3.1 → 0.5.0

package/dist/gen-ts/ai-transform-event.d.ts

@@ -0,0 +1,66 @@
+export type AiTransformIdentifier = string;
+export type AiTransformDigest = string;
+export type AiTransformPlanEntry = {
+    [k: string]: unknown;
+} & {
+    callSiteFingerprint: AiTransformDigest;
+    sourcePath: string;
+    expectedSourceFileSha256: AiTransformDigest;
+    strategy: 'deployment_injection' | 'deterministic_adapter';
+    configurationMappingId?: AiTransformIdentifier;
+    configurationMappingVersion?: string;
+    transformId?: AiTransformIdentifier;
+    transformVersion?: string;
+    /**
+     * @minItems 1
+     * @maxItems 32
+     */
+    allowedSyntaxKinds: [AiTransformIdentifier, ...AiTransformIdentifier[]];
+    runtimeShimName?: string;
+    runtimeShimVersion?: string;
+    runtimeShimDigest?: AiTransformDigest;
+} & {
+    callSiteFingerprint: AiTransformDigest;
+    sourcePath: string;
+    expectedSourceFileSha256: AiTransformDigest;
+    strategy: 'deployment_injection' | 'deterministic_adapter';
+    configurationMappingId?: AiTransformIdentifier;
+    configurationMappingVersion?: string;
+    transformId?: AiTransformIdentifier;
+    transformVersion?: string;
+    /**
+     * @minItems 1
+     * @maxItems 32
+     */
+    allowedSyntaxKinds: [AiTransformIdentifier, ...AiTransformIdentifier[]];
+    runtimeShimName?: string;
+    runtimeShimVersion?: string;
+    runtimeShimDigest?: AiTransformDigest;
+};
+/**
+ * Checksum-bound deterministic AI interception task input. Entries are the complete ordered PLAN interception plan so the task can verify the governance plan digest before applying its deterministic subset; source and patches are referenced, never embedded.
+ */
+export interface AiTransformEvent {
+    schema: 'harbour.ai-transform-event/1.0';
+    tenantId: AiTransformIdentifier;
+    appId: AiTransformIdentifier;
+    environment: AiTransformIdentifier;
+    versionId: string;
+    sourceRevision: string;
+    workspace: AiTransformWorkspace;
+    inventoryDigest: AiTransformDigest;
+    policyDigest: AiTransformDigest;
+    runtimeContractDigest: AiTransformDigest;
+    interceptionPlanDigest: AiTransformDigest;
+    /**
+     * @minItems 1
+     * @maxItems 1000
+     */
+    entries: [AiTransformPlanEntry, ...AiTransformPlanEntry[]];
+}
+export interface AiTransformWorkspace {
+    bucket: string;
+    key: string;
+    sha256: AiTransformDigest;
+    size: number;
+}

package/dist/gen-ts/ai-transform-result.d.ts

@@ -0,0 +1,32 @@
+export type AiTransformResultDigest = string;
+export type AiTransformResultIdentifier = string;
+/**
+ * Bounded deterministic interception result; contains descriptors and digest evidence only.
+ */
+export interface AiTransformResult {
+    schema: 'harbour.ai-transform-result/1.0';
+    workspace: AiTransformResultWorkspace;
+    interceptionPlanDigest: AiTransformResultDigest;
+    transformerVersion: string;
+    /**
+     * @minItems 1
+     * @maxItems 1000
+     */
+    applied: [AiTransformApplied, ...AiTransformApplied[]];
+}
+export interface AiTransformResultWorkspace {
+    bucket: string;
+    key: string;
+    sha256: AiTransformResultDigest;
+    size: number;
+}
+export interface AiTransformApplied {
+    callSiteFingerprint: AiTransformResultDigest;
+    transformId: AiTransformResultIdentifier;
+    transformVersion: string;
+    sourcePath: string;
+    beforeSha256: AiTransformResultDigest;
+    afterSha256: AiTransformResultDigest;
+    governedBoundaryFingerprint: AiTransformResultDigest;
+    runtimeShimDigest: AiTransformResultDigest;
+}

package/dist/gen-ts/ai-verification-evidence.d.ts

@@ -0,0 +1,49 @@
+export type AiVerificationIdentifier = string;
+export type AiVerificationDigest = string;
+/**
+ * Bounded, value-free evidence submitted by deployment verification for one governed version.
+ */
+export interface AiVerificationEvidence {
+    schema: 'harbour.ai-verification-evidence/1.0';
+    tenantId: AiVerificationIdentifier;
+    appId: AiVerificationIdentifier;
+    environment: AiVerificationIdentifier;
+    versionId: string;
+    sourceRevision: string;
+    inventoryDigest: AiVerificationDigest;
+    interceptionPlanDigest: AiVerificationDigest;
+    runtimeContractDigest: AiVerificationDigest;
+    policyDigest: AiVerificationDigest;
+    finalWorkspaceDigest: AiVerificationDigest;
+    /**
+     * @maxItems 1000
+     */
+    verifiedCallsiteFingerprints: AiVerificationDigest[];
+    /**
+     * @maxItems 1000
+     */
+    appliedTransforms: AiVerificationTransform[];
+    /**
+     * @minItems 1
+     * @maxItems 32
+     */
+    endpointChecks: [AiVerificationEndpointCheck, ...AiVerificationEndpointCheck[]];
+    providerCredentialsAbsent: true;
+    smokeTraceId: string;
+    evidenceDigest: AiVerificationDigest;
+    verifiedAt: string;
+}
+export interface AiVerificationTransform {
+    callSiteFingerprint: AiVerificationDigest;
+    governedBoundaryFingerprint: AiVerificationDigest;
+    transformId: AiVerificationIdentifier;
+    transformVersion: string;
+    beforeSha256: AiVerificationDigest;
+    afterSha256: AiVerificationDigest;
+    runtimeShimDigest: AiVerificationDigest;
+}
+export interface AiVerificationEndpointCheck {
+    name: AiVerificationIdentifier;
+    passed: true;
+    configurationMappingVersion: string;
+}

package/dist/gen-ts/data-dependency.d.ts

@@ -0,0 +1,42 @@
+/**
+ * database = a SQL/warehouse connection; api = an HTTP(S) service; app_owned_external = infrastructure the app owns outside Harbour.
+ */
+export type DataDependencyKind = 'database' | 'api' | 'app_owned_external';
+/**
+ * matched = resolved to a registered source; out_of_scope = resolved but not requestable; unknown = unresolvable; inventory = registered but unused; app_owned_external = app-owned, outside Harbour's remit.
+ */
+export type DataDependencyClassification = 'matched' | 'out_of_scope' | 'unknown' | 'inventory' | 'app_owned_external';
+/**
+ * declared = stated by the builder; detected = found by analysis.
+ */
+export type DataDependencyOrigin = 'declared' | 'detected';
+/**
+ * A single external data dependency of an app, either declared by the builder or detected during analysis. Classification records how the dependency resolved against the tenant's registered data-source inventory; matchedSourceId is present only when classification is matched.
+ */
+export interface DataDependency {
+    kind: DataDependencyKind;
+    identifiers: DataDependencyIdentifiers;
+    classification: DataDependencyClassification;
+    /**
+     * sourceId of the registered data source this dependency matched; present only when classification is matched.
+     */
+    matchedSourceId?: string;
+    origin: DataDependencyOrigin;
+}
+/**
+ * Evidence identifying the dependency; used to match it against the registered source inventory.
+ */
+export interface DataDependencyIdentifiers {
+    /**
+     * Hostnames the dependency was observed or declared against.
+     */
+    hosts: string[];
+    /**
+     * Client driver/library that surfaced the dependency (e.g. pg, snowflake-sdk).
+     */
+    driver?: string;
+    /**
+     * Environment-variable names the app reads to configure this dependency.
+     */
+    envNames: string[];
+}

package/dist/gen-ts/data-grant.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Access mode. MVP is read-only; write is a deliberate future schema change.
+ */
+export type DataGrantMode = 'read';
+/**
+ * MVP: one minted service principal per grant. Per-end-user passthrough is a future schema change.
+ */
+export type DataGrantIdentityModel = 'service';
+/**
+ * Grant lifecycle state. Legal edges live in x-transitions; GRANTED and DENIED are terminal.
+ */
+export type DataGrantStatus = 'REQUESTED' | 'GRANTED' | 'DENIED';
+/**
+ * An app's approved (or requested) read scope against a registered data source. MVP is deliberately narrow: mode is read-only and identityModel is service (one minted principal per grant, no per-end-user identity passthrough). Grant status is a tiny state machine — legal edges live in x-transitions and codegen turns them into shared CanTransitionDataGrantStatus / IsTerminalDataGrantStatus helpers so control-plane and consumers agree on legality.
+ */
+export interface DataGrant {
+    /**
+     * App the grant belongs to.
+     */
+    appId: string;
+    /**
+     * Registered data source the grant targets (data-source.schema.json).
+     */
+    sourceId: string;
+    /**
+     * Requested/granted selectors; every selector must fall inside the source's allowedScope.
+     *
+     * @minItems 1
+     */
+    scope: [string, ...string[]];
+    mode: DataGrantMode;
+    identityModel: DataGrantIdentityModel;
+    status: DataGrantStatus;
+    /**
+     * secretref URI of the minted per-grant credential; present once GRANTED.
+     */
+    credentialRef?: string;
+    /**
+     * Name of the scoped principal minted on the source for this grant; present once GRANTED.
+     */
+    mintedPrincipal?: string;
+    /**
+     * Operation (e.g. deployment analysis) that raised the request, for audit correlation.
+     */
+    requestedByOperationId?: string;
+    /**
+     * Admin identity that resolved the request; present once GRANTED or DENIED.
+     */
+    approvedBy?: string;
+    /**
+     * RFC 3339 instant the request was resolved; present once GRANTED or DENIED.
+     */
+    approvedAt?: string;
+}
+/** True iff from→to is a legal DataGrantStatus edge (schema x-transitions). */
+export declare function canTransitionDataGrantStatus(from: string, to: string): boolean;
+/** True iff the DataGrantStatus is terminal (GRANTED, DENIED). */
+export declare function isTerminalDataGrantStatus(state: string): boolean;

package/dist/gen-ts/data-grant.js

@@ -0,0 +1,12 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+const legalDataGrantStatusTransitions = {
+    "REQUESTED": { "GRANTED": true, "DENIED": true },
+};
+const terminalDataGrantStatusStates = new Set(["GRANTED", "DENIED"]);
+/** True iff from→to is a legal DataGrantStatus edge (schema x-transitions). */
+export function canTransitionDataGrantStatus(from, to) {
+    return Boolean(legalDataGrantStatusTransitions[from]?.[to]);
+}
+/** True iff the DataGrantStatus is terminal (GRANTED, DENIED). */
+export function isTerminalDataGrantStatus(state) { return terminalDataGrantStatusStates.has(state); }

package/dist/gen-ts/data-source.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Closed connector set for the Data-Access MVP.
+ */
+export type DataSourceConnector = 'postgres' | 'redshift' | 'bigquery' | 'databricks';
+/**
+ * byo = admin brought existing infrastructure; harbour_managed = Harbour provisioned it.
+ */
+export type DataSourceProvisioningMode = 'byo' | 'harbour_managed';
+/**
+ * DISABLED sources reject new grants and suspend existing access.
+ */
+export type DataSourceStatus = 'ACTIVE' | 'DISABLED';
+/**
+ * An admin-registered external data source (Data-Access MVP). The credential the platform holds for the source never crosses this boundary — credentialRef is a secretref URI resolved internally. allowedScope is the admin-declared selector allowlist grants are checked against; observedScope is what discovery actually saw and is informational only.
+ */
+export interface DataSource {
+    /**
+     * Owning tenant (org) identifier.
+     */
+    tenantId: string;
+    /**
+     * Tenant-unique data-source identifier.
+     */
+    sourceId: string;
+    connector: DataSourceConnector;
+    /**
+     * Human-readable name shown to admins and builders.
+     */
+    displayName: string;
+    endpoint: DataSourceEndpoint;
+    /**
+     * secretref URI naming the platform-held credential for this source. The referenced value never crosses this boundary.
+     */
+    credentialRef: string;
+    provisioningMode: DataSourceProvisioningMode;
+    /**
+     * Admin-declared selector allowlist (e.g. schema.table patterns) that grant scopes are validated against.
+     */
+    allowedScope: string[];
+    /**
+     * Selectors discovery actually observed on the source. Informational; never widens allowedScope.
+     */
+    observedScope?: string[];
+    /**
+     * Whether builders may request grants against this source.
+     */
+    requestableByBuilders: boolean;
+    status: DataSourceStatus;
+}
+/**
+ * Connector endpoint coordinates. host is always present; database vs project/workspace depends on the connector family.
+ */
+export interface DataSourceEndpoint {
+    /**
+     * Network host (or warehouse endpoint) of the source.
+     */
+    host: string;
+    /**
+     * TCP port; absent where the connector implies it.
+     */
+    port?: number;
+    /**
+     * Database name (postgres/redshift-style connectors).
+     */
+    database?: string;
+    /**
+     * Project identifier (bigquery-style connectors).
+     */
+    project?: string;
+    /**
+     * Workspace identifier (databricks-style connectors).
+     */
+    workspace?: string;
+}

package/dist/{deploy-request.d.ts → gen-ts/deploy-request.d.ts}

@@ -1,3 +1,23 @@
+/**
+ * One environment-variable binding: exactly one of secretRef (secret, resolved at runtime) or value (plain literal).
+ */
+export type DeployRequestEnvironmentBinding = {
+    /**
+     * Environment-variable name the app reads.
+     */
+    name: string;
+    /**
+     * secretref URI resolved at runtime; the value never appears in the request.
+     */
+    secretRef?: string;
+    /**
+     * Plain (non-secret) literal value.
+     */
+    value?: string;
+} & DeployRequestEnvironmentBinding1;
+export type DeployRequestEnvironmentBinding1 = {
+    [k: string]: unknown;
+};
 /**
  * JSON body for POST /v1/tenants/{tenant}/apps/{app}/deployments. tenant and app come from path parameters and are not body fields. The preview MVP requires environment=preview. Every accepted POST is a new deployment intent; idempotencyKey is retained only as request correlation.
  */
@@ -19,6 +39,7 @@ export interface DeployRequest {
      * Optional legacy request-correlation value returned as requestId. It does not make repeated HTTP POSTs idempotent; versionId is the deployment identity and SQS deduplication key.
      */
     idempotencyKey?: string;
+    environmentBindings?: DeployRequestEnvironmentBindings;
 }
 export interface DeployRequestSource {
     /**
@@ -30,3 +51,12 @@ export interface DeployRequestSource {
      */
     repositoryUrl: string;
 }
+/**
+ * Optional runtime environment configuration (Secret-Manager MVP). Named environmentBindings, not environment — the existing required `environment` property is the deployment-target token and predates this object. Additive: requests without it remain valid.
+ */
+export interface DeployRequestEnvironmentBindings {
+    /**
+     * Environment-variable bindings for this deployment.
+     */
+    bindings: DeployRequestEnvironmentBinding[];
+}

package/dist/gen-ts/deploy-response.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/deployment-environment.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/deployment-source.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/deployment-status-failure.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/deployment-status-request.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/{deployment-status-response.d.ts → gen-ts/deployment-status-response.d.ts}

@@ -6,8 +6,8 @@ export interface DeploymentStatusResponse {
     versionId: string;
     tenant: string;
     app: string;
-    environment: 'preview';
-    status: 'QUEUED' | 'ANALYZING' | 'TRANSFORMING' | 'VALIDATING' | 'BUILDING' | 'VERIFYING' | 'GATING' | 'LIVE' | 'FAILED' | 'STALE';
+    environment: 'preview' | 'prod';
+    status: 'QUEUED' | 'ANALYZING' | 'TRANSFORMING' | 'VALIDATING' | 'BUILDING' | 'VERIFYING' | 'GATING' | 'LIVE' | 'AWAITING-PROMOTION' | 'PROMOTING' | 'FAILED' | 'STALE';
     message: string;
     branch: string;
     commit: string;

package/dist/gen-ts/deployment-status-response.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/env-bindings.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/{error-category-registry.d.ts → gen-ts/error-category-registry.d.ts}

@@ -27,6 +27,13 @@ export declare const ErrorCategories: {
     readonly AdmissionAppNotRegistered: "admission.app-not-registered";
     readonly DeployCommitNotOnBranch: "deploy.commit-not-on-branch";
     readonly DeployQueuePublicationFailed: "deploy.queue-publication-failed";
+    readonly PromotionPreviewNotPromotable: "promotion.preview-not-promotable";
+    readonly PromotionProductionBranchMoved: "promotion.production-branch-moved";
+    readonly PromotionSourceTreeMismatch: "promotion.source-tree-mismatch";
+    readonly PromotionArtifactMismatch: "promotion.artifact-mismatch";
+    readonly PromotionIdempotencyConflict: "promotion.idempotency-conflict";
+    readonly PromotionInProgress: "promotion.in-progress";
+    readonly PromotionQueuePublicationFailed: "promotion.queue-publication-failed";
     readonly CutoverFlipFailed: "cutover.flip-failed";
 };
 /** Retryable lookup for a concrete or family-suffixed category. Unknown → false (fail closed). */

package/dist/{error-category-registry.js → gen-ts/error-category-registry.js}

@@ -29,6 +29,13 @@ export const ErrorCategories = {
     AdmissionAppNotRegistered: "admission.app-not-registered",
     DeployCommitNotOnBranch: "deploy.commit-not-on-branch",
     DeployQueuePublicationFailed: "deploy.queue-publication-failed",
+    PromotionPreviewNotPromotable: "promotion.preview-not-promotable",
+    PromotionProductionBranchMoved: "promotion.production-branch-moved",
+    PromotionSourceTreeMismatch: "promotion.source-tree-mismatch",
+    PromotionArtifactMismatch: "promotion.artifact-mismatch",
+    PromotionIdempotencyConflict: "promotion.idempotency-conflict",
+    PromotionInProgress: "promotion.in-progress",
+    PromotionQueuePublicationFailed: "promotion.queue-publication-failed",
     CutoverFlipFailed: "cutover.flip-failed",
 };
 const retryableExact = {
@@ -60,6 +67,13 @@ const retryableExact = {
     "admission.app-not-registered": false,
     "deploy.commit-not-on-branch": false,
     "deploy.queue-publication-failed": true,
+    "promotion.preview-not-promotable": false,
+    "promotion.production-branch-moved": false,
+    "promotion.source-tree-mismatch": false,
+    "promotion.artifact-mismatch": false,
+    "promotion.idempotency-conflict": false,
+    "promotion.in-progress": true,
+    "promotion.queue-publication-failed": true,
     "cutover.flip-failed": false,
 };
 const retryableFamilies = {

package/dist/gen-ts/error-category.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/error-envelope.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/{index.d.ts → gen-ts/index.d.ts}

@@ -1,5 +1,18 @@
+export * from './ai-callsite-inventory.js';
+export * from './ai-gateway-key-lookup.js';
+export * from './ai-gateway-key-token.js';
+export * from './ai-governance-decision.js';
+export * from './ai-policy-snapshot.js';
+export * from './ai-runtime-contract.js';
+export * from './ai-trace-event.js';
+export * from './ai-transform-event.js';
+export * from './ai-transform-result.js';
+export * from './ai-verification-evidence.js';
 export * from './api-error-response.js';
 export * from './artifact-contract.js';
+export * from './data-dependency.js';
+export * from './data-grant.js';
+export * from './data-source.js';
 export * from './deploy-request.js';
 export * from './deploy-response.js';
 export * from './deployment-environment.js';
@@ -12,5 +25,8 @@ export * from './error-category-registry.js';
 export * from './error-category.js';
 export * from './error-envelope.js';
 export * from './kvs-routing-entry.js';
+export * from './promotion-request.js';
+export * from './promotion-response.js';
+export * from './secret-reference.js';
 export * from './version-state-machine.js';
 export * from './version-state.js';

package/dist/{index.js → gen-ts/index.js}

@@ -1,7 +1,20 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export * from './ai-callsite-inventory.js';
+export * from './ai-gateway-key-lookup.js';
+export * from './ai-gateway-key-token.js';
+export * from './ai-governance-decision.js';
+export * from './ai-policy-snapshot.js';
+export * from './ai-runtime-contract.js';
+export * from './ai-trace-event.js';
+export * from './ai-transform-event.js';
+export * from './ai-transform-result.js';
+export * from './ai-verification-evidence.js';
 export * from './api-error-response.js';
 export * from './artifact-contract.js';
+export * from './data-dependency.js';
+export * from './data-grant.js';
+export * from './data-source.js';
 export * from './deploy-request.js';
 export * from './deploy-response.js';
 export * from './deployment-environment.js';
@@ -14,5 +27,8 @@ export * from './error-category-registry.js';
 export * from './error-category.js';
 export * from './error-envelope.js';
 export * from './kvs-routing-entry.js';
+export * from './promotion-request.js';
+export * from './promotion-response.js';
+export * from './secret-reference.js';
 export * from './version-state-machine.js';
 export * from './version-state.js';

package/dist/gen-ts/kvs-routing-entry.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/promotion-request.d.ts

@@ -0,0 +1,17 @@
+/**
+ * JSON body for POST /v1/tenants/{tenant}/apps/{app}/promotions. Repository identity is loaded from stored application and preview records, not supplied by the caller.
+ */
+export interface PromotionRequest {
+    /**
+     * Immutable preview version selected by the caller. The API also verifies that its tenant and app match the route.
+     */
+    previewVersionId: string;
+    /**
+     * Current commit at the configured production branch head. Its root Git tree must equal the preview tree.
+     */
+    commit: string;
+    /**
+     * Durable caller-generated key. Identical replays return the original production version; reuse with a changed request is rejected.
+     */
+    idempotencyKey: string;
+}

package/dist/gen-ts/promotion-request.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/promotion-response.d.ts

@@ -0,0 +1,17 @@
+/**
+ * 202 Accepted body returned after the production version and its durable idempotency binding exist.
+ */
+export interface PromotionResponse {
+    idempotencyKey: string;
+    /**
+     * Immutable identity of the admitted production version.
+     */
+    versionId: string;
+    previewVersionId: string;
+    tenant: string;
+    app: string;
+    environment: 'prod';
+    status: 'QUEUED';
+    acceptedAt: string;
+    statusUrl: string;
+}

package/dist/gen-ts/promotion-response.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/gen-ts/secret-reference.d.ts

@@ -0,0 +1,36 @@
+/**
+ * app = shared by the whole app; personal = owned by a single builder (ownerBuilderId).
+ */
+export type SecretReferenceScope = 'app' | 'personal';
+/**
+ * UNSET slots block promotion until a human sets a value (secrets.unresolvable).
+ */
+export type SecretReferenceStatus = 'SET' | 'UNSET';
+/**
+ * builder = created by a builder; minted = created by the platform (e.g. a data-grant credential).
+ */
+export type SecretReferenceOrigin = 'builder' | 'minted';
+/**
+ * Secret-Manager MVP: a named secret slot an app depends on. Only the reference and its lifecycle cross this boundary — the secret VALUE never appears in any contract. scope=app secrets are shared by the app; scope=personal secrets belong to one builder (ownerBuilderId). origin records whether a builder created the slot or the platform minted it (e.g. for a data grant).
+ */
+export interface SecretReference {
+    /**
+     * App the secret slot belongs to.
+     */
+    appId: string;
+    /**
+     * Slot name as the app references it (typically the environment-variable name).
+     */
+    name: string;
+    scope: SecretReferenceScope;
+    /**
+     * Owning builder; present only when scope is personal.
+     */
+    ownerBuilderId?: string;
+    /**
+     * secretref URI of the stored value. The value itself never crosses this boundary.
+     */
+    secretRef: string;
+    status: SecretReferenceStatus;
+    origin: SecretReferenceOrigin;
+}

package/dist/gen-ts/secret-reference.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/dist/{version-state-machine.d.ts → gen-ts/version-state-machine.d.ts}

@@ -13,7 +13,12 @@ export declare const States: {
     readonly STALE: "STALE";
 };
 export type StateName = (typeof States)[keyof typeof States];
-/** True iff from→to is a legal edge in the T1a state machine. */
-export declare function canTransition(from: string, to: string): boolean;
+export declare const Environments: {
+    readonly Preview: "preview";
+    readonly Prod: "prod";
+};
+export type EnvironmentName = (typeof Environments)[keyof typeof Environments];
+/** True iff from→to is a legal edge for environment in the T1a state machine. */
+export declare function canTransition(environment: string, from: string, to: string): boolean;
 /** True iff the state is terminal (FAILED, STALE). */
 export declare function isTerminal(state: string): boolean;